robogg133/packets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

missed return in mkdir function

Browse Source
This commit is contained in:
roboogg133
2025-08-20 15:33:12 -03:00
parent 6775002886
commit 0c81469566
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
internal/internal.go
View File

@@ -443,11 +443,13 @@ func LMkdir(L *lua.LState) int {
if !IsSafe(path) { if !IsSafe(path) {
L.Push(lua.LFalse) L.Push(lua.LFalse)
L.Push(lua.LString("[packets] unsafe filepath\n")) L.Push(lua.LString("[packets] unsafe filepath\n"))
return 2
} }
if err := os.MkdirAll(path, os.FileMode(perm)); err != nil { if err := os.MkdirAll(path, os.FileMode(perm)); err != nil {
L.Push(lua.LFalse) L.Push(lua.LFalse)
L.Push(lua.LString("[packets] mkdir failed\n" + err.Error())) L.Push(lua.LString("[packets] mkdir failed\n" + err.Error()))
return 2
} }
L.Push(lua.LTrue) L.Push(lua.LTrue)
@@ -462,13 +464,16 @@ func LuaCompile(L *lua.LState) int {
if strings.Contains(L.CheckString(i), "/") { if strings.Contains(L.CheckString(i), "/") {
tryintoacess, err := filepath.Abs(filepath.Clean(L.CheckString(i))) tryintoacess, err := filepath.Abs(filepath.Clean(filepath.Join(SandboxDir, L.CheckString(i))))
if err != nil { if err != nil {
L.Push(lua.LFalse) L.Push(lua.LFalse)
L.Push(lua.LString("[packets] invalid filepath\n" + err.Error())) L.Push(lua.LString("[packets] invalid filepath\n" + err.Error()))
return 2 return 2
} }
if !strings.HasPrefix(tryintoacess, SandboxDir) {
fmt.Printf("sandboxdir: (%s) acessto: (%s)\n", SandboxDir, tryintoacess)
rel, err := filepath.Rel(SandboxDir, tryintoacess)
if err != nil || strings.HasPrefix(rel, "..") {
L.Push(lua.LFalse) L.Push(lua.LFalse)
L.Push(lua.LString("[packets] unsafe filepath")) L.Push(lua.LString("[packets] unsafe filepath"))
return 2 return 2